Before focusing on the results of the latest study, we would like to reaffirm the definition of risk profile, risk appetite and risk tolerance found in our previous publications:

Risk Profile: The broad parameters a firm considers in executing its business strategy in its chosen market space.

Risk Appetite: The level of uncertainty a company is willing to assume given the corresponding reward associated with risk. A company with a high appetite for risk would be a company accepting more uncertainty for a higher reward, while a company with a low risk appetite would seek less uncertainty for which it would accept a lower return.

Risk Tolerance: A stated amount of risk a company is willing and/or able to keep in executing its business strategy - in other words, the limits of a company’s capacity for taking risk.

Putting these definitions in perspective, a company’s risk profile comprises the lines of business or the markets in which the company operates. Within the company’s risk profile, it will define its general risk appetite taking into account its risk mitigation costs and targets for return on equity, return on assets and profitability. After determining its appetite for risk the company will finally formulate its risk tolerance profile. This will enable it to state well-specified risk objectives in terms of value at risk (VaR), tail value at risk (TVaR), probable maximum loss (PML) or other metrics that define loss.

The Study

Guy Carpenter’sERM Benchmark study is based on data from publicly-available 2012 financial reports and publications of (re)insurers from all over the world. In order to improve the depth of the analysis we have increased the number of insurance groups included. The sample now comprises 67 different companies from the four largest world markets, compared to the 35 companies used in 2009. The study contains information from 27 companies domiciled in Europe, 9 in the United States, 12 in Bermuda and 19 in the Asia Pacific region. The firms included are mainly publicly traded and have large global operations.

The results of the study indicate the focus on risk continues and that disclosure is improving:

The majority of the companies include a dedicated risk section in their financial reports.

The risk reports are getting more homogeneous and comparable in each market. Finding risk-related information in the annual reports is becoming easier.

Even though the general disclosure level is quite high in Europe, improvement compared to the last studies is not as significant as what has been seen in the United States, especially with regards to insurance risk.

In the past, companies published more details such as descriptions of the value-based management system in place to show rating agencies and financial analysts the progress of ERM. However, most companies in Europe today appear to be aligning their reporting detail with what is required by regulators. The majority of the companies disclose at least qualitative information about four principal risks: market, credit, insurance and operational. Moreover, a relatively good level of disclosure exists for catastrophe risks.

An increasing number of companies (especially in Europe) also disclose specific quantitative information about their risk tolerances.

The following table summarizes the spectrum of risk measurements and methodologies used by companies to disclose their risk levels.

The prevalent risk metric is by far the VaR. The VaR reports and calculations are reinforced by the results from sensitivity analyses and stress testing (depending on the size of the “deterioration factor”). Metrics used to disclose the risk tolerance level for catastrophe risk are less strict and PML or scenario methods are generally preferred.

Nearly all companies in Europe now use the VaR at the 99.5 percentile to measure the risks according to Solvency II requirements for capitalizing against the 1-in-200-year event. Some of the companies use dedicated buffers to reflect higher rating requirements, for example 175 percent Solvency II ratio as minimum capital requirement. In the past we saw more diverse risk metrics in place, such as 99.97 percent VaR or 99 percent TVaR, but there has been convergence toward the Solvency II level.